Roku forces reset after 15,000 accounts compromised

You might not be able to put a price on happiness, but you can put a price on your stolen data. Roku announced that more than 15,000 customers were impacted by a credential stuffing attack late last week, and now Bleeping Computer reports that hundreds of those accounts are being sold on stolen account marketplaces for as little as 50 cents. The company says that users were locked out of their accounts and the threat actors were able to change information on passwords, email addresses, and shipping addresses. This allows those who bought the information or the threat actors themselves to make purchases using stored credit card information without the legitimate account holder receiving any confirmation emails. Roku says they have secured the impacted accounts and forced a password reset.

(Bleeping Computer) 

French government agencies targeted in “unprecedented” attacks  

The French Prime Minister’s office disclosed that multiple French government agencies were subjected to “intense” cyberattacks, with characteristics suggesting they were distributed-denial-of-service (DDoS) attacks. These attacks, described with “unprecedented intensity,” aimed to overload servers with excessive requests, hindering access to network resources without stealing information. The French government has not attributed the event to any group, although similar incidents have historically been linked to groups supporting Russia’s actions in Ukraine, some possibly with external backing. In response, the French government activated a crisis cell to implement countermeasures, successfully mitigating the impact and restoring access to most state websites. 

(The Record)

Fintech firm taken offline by ransomware attack 

The irony is never lost on me when a company claims their solutions “reduce risk,” only to then become the victim of a ransomware attack. This was the case for EquiLend Holdings, a New York-based securities lending platform that was forced to take its systems offline in late January following an attack. Bloomberg reports that the LockBit ransomware gang claimed responsibility, though EquiLend did not confirm this. The company notified employees that the attackers had stolen sensitive information, including names, birthdates, and social security numbers. EquiLend employs 330 employees across three continents, and its services are used by more than 190 firms worldwide.

(Bleeping Computer)

Okta says alleged data leak not their data 

The Okta cyberattack is back in the conversation, well, sort of. As a refresher, in October 2023, hackers breached Okta, a provider of cloud identity and access management solutions, accessing data from all Okta customers. There hasn’t been much talk of the attack since, but over the weekend, a user under the alias “Ddarknotevil” claims he posted the Okta Database containing information of 3,800 customers’ data stolen in the attack last year. Okta clarified to Bleeping Computer the data isn’t theirs and is likely public information. The company says, after a weekend inspection, they found no evidence of a new breach.

(Bleeping Computer)

Huge thanks to our sponsor, Vanta

White House launches secure software development initiative

The Biden-Harris Administration introduced a new secure software development attestation form to enhance digital security across the U.S. This initiative requires software producers working with the federal government to confirm they follow secure development practices. The move is part of efforts to improve cybersecurity in response to major threats, like the SolarWinds incident, and aligns with President Biden’s Executive Order on improving the nation’s cybersecurity. It aims to ensure the government uses software that is secure by design, benefiting not just government operations but also enhancing security standards globally.

(CISA)

Biden asks for increased funding for cybersecurity programs 

While on the topic of the White House, President Biden released his budget proposal for fiscal year 2025, and the administration is asking for $13 billion in cybersecurity funding. Cyberscoop reports highlights include an additional $103 million to the Cybersecurity and Infrastructure Security Agency (CISA) for a total of $3 billion for the agency. Notably, $800 million was earmarked to help low-resource hospitals cover the initial costs of implementing a basic cybersecurity program, and a $500 million incentive for more robust programs. While many are skeptical as to whether the budget will pass, it does give a good indication of the administration’s priorities.

(Cyberscoop)

Beware of fake crypto drainer apps 

Wallet drainers, or crypto drainers, are becoming the new hot commodity for hackers. These drainers are apps or malicious scripts that trick users into entering their login information, after which the attacker is able to steal all their digital assets—simple but effective. Leather, a cryptocurrency wallet platform, posted on their X account (formerly Twitter), warning users not to download the Leather Wallet app on the Apple App Store because it doesn’t exist and they will let users know once they officially release an app to the public. As of this recording, it seems the fake app has now been removed from the store.

(Bleeping Computer)

First the beer, now the coffee, what’s next? 

A Belgian village has taken a one-two punch with another ransomware attack. We first reported that the popular beer makers—Duvel Brewery—were hit by a cyberattack last week; now, we’ve learned a local coffee company, less than a mile apart, was hit by a similar attack. It’s important to note, these are not your mom-and-pop beer and coffee shops. According to The Record, Beyers is the largest coffee roaster in Belgium and employs more than 200 people in five   countries, while Duvel is an international exporter of beer. Production of the beer in Belgium and at the U.S. facility is still shut down. But, as I mentioned last week, a spokesperson for the beer company says, “there is enough stock, so Duvel drinkers don’t have to worry.”

(The Record)